Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

First-party isolation in Firefox: what breaks if you enable it?

ctrl.blog

Post reply on HN
Print view View original

111–120 of 120 posts

Re: First-party isolation in Firefox: what breaks if you enable it?

#111

Post by tomrittervg »

user812 wrote: post #110
tomrittervg wrote: post #106

Earlier quoted context omitted.

Go to https://ritter.vg/misc/ff/fpi.html On first load it should say "There was nothing in local storage." Now go to https://rittervg.com/misc/ff/fpi.html On first load it should say the same. If it says the same timestamp that was stored on the first page - it's not working. Source: I'm a Mozilla Developer who is one of the primary devs/supporters of First Party Isolation.

What if the box is empty? JS is allowed. (Edit: I guess the culprit is "third party cookies blocked by default") So wouldn't a better test be about a third party that was used in a first party context before? Since FPI goes beyond third party cookies.

Thanks for diagnosing that for me, you're right blocking third party cookies does cause it to fail.

Both tests are equally valid. I just gave one because trying to be exhaustive about testing it would be mind-numbing. The test I provded only does localstorage, but FPI also isolates DNS cache, H2, image cache, favicons, cookies, localstorage, indexdb, etc etc

You can do yours by visiting https://anonymity.is/misc/ff/fpi-iframe.html first; then visit the ritter.vg and rittervg.com links.

Re: First-party isolation in Firefox: what breaks if you enable it?

#112

Post by user812 »

tomrittervg wrote: post #111
user812 wrote: post #110

Earlier quoted context omitted.

What if the box is empty? JS is allowed. (Edit: I guess the culprit is "third party cookies blocked by default") So wouldn't a better test be about a third party that was used in a first party context before? Since FPI goes beyond third party cookies.

Thanks for diagnosing that for me, you're right blocking third party cookies does cause it to fail. Both tests are equally valid. I just gave one because trying to be exhaustive about testing it would be mind-numbing. The test I provded only does localstorage, but FPI also isolates DNS cache, H2, image cache, favicons, cookies, localstorage, indexdb, etc etc You can do yours by visiting https://anonymity.is/misc/ff/f…

Thanks for the clarification.

What surprises me the most is that not only Firefox but also my Safari Browser passes all those tests when ITP is enabled.

Re: First-party isolation in Firefox: what breaks if you enable it?

#113

Post by seba_dos1 »

wfh wrote: post #72
jedberg wrote: post #70

I've been doing this the hard way for years -- running four browsers at all times, each for different things. Chrome is logged into Google, Firefox is logged into Facebook, Safari is for HN/Reddit, and Chrome canary is for other random sites that I don't want to have already logged in, like when I use the AWS console. And then I also use incognito windows for going to forums and deal sites and all those sites known f…

have you considered using multiple profiles/containers in one browser e.g. Firefox supports containers, and Chrome supports profiles?

Firefox actually supports both. It already supported profiles way before Chrome existed, and recently got support of containers.

Re: First-party isolation in Firefox: what breaks if you enable it?

#114

Post by dang »

mixmastamyk wrote: post #97
dang wrote: post #96

Earlier quoted context omitted.

I read it as you calling the other user a bootlicker.

It's a class of folks with a certain perspective. Whether a person chooses to join it at a particular time is their business. It is the difference between saying you ARE bad, versus you SAID/DID a bad thing. I didn't say the person was one on purpose, perhaps wording not strong enough.

I'm not sure what you're trying to argue here, but you can't call people names like bootlicker on HN. This is in the site guidelines: https://news.ycombinator.com/newsguidelines.html

If you'd please err on the side of being respectful in the future, we'd be grateful.

Re: First-party isolation in Firefox: what breaks if you enable it?

#116

Post by d2wa »

olliej wrote: post #78
d2wa wrote: post #10

Earlier quoted context omitted.

I use “alternative search engines” daily. However, I have to crawl back to Google if I want to find things that were published in the last two weeks. Even Microsoft Bing can’t keep up with all the content that appears on the web every day.

Right? I tried so hard to use duck duck go and bing, but at some point DDG seemed to start producing very bing-like results, and bing is just not as good as google for technical searches - apparently by design, they believe their results are better for general users. Kind of frustrating :-/

DDG is powered by Bing and Yandex. DDG doesn't have their own index.

Re: First-party isolation in Firefox: what breaks if you enable it?

#117

Post by d2wa »

t0astbread wrote: post #115

What about just using uMatrix (or similar extensions)? You have more precise control over what gets allowed and what not and you can just temporarily or partially disable protection for logins/payments etc.

It's not the same thing at all. See this discussion to learn the differences of uMatrix and FPI. https://www.reddit.com/r/javascript/comments/9edeqe/firstpar...

Re: First-party isolation in Firefox: what breaks if you enable it?

#119

Post by tomrittervg »

user812 wrote: post #112
tomrittervg wrote: post #111

Earlier quoted context omitted.

Thanks for diagnosing that for me, you're right blocking third party cookies does cause it to fail. Both tests are equally valid. I just gave one because trying to be exhaustive about testing it would be mind-numbing. The test I provded only does localstorage, but FPI also isolates DNS cache, H2, image cache, favicons, cookies, localstorage, indexdb, etc etc You can do yours by visiting https://anonymity.is/misc/ff/f…

Thanks for the clarification. What surprises me the most is that not only Firefox but also my Safari Browser passes all those tests when ITP is enabled.

Safari by default has a stricter storage access policy by default for all third-party domains, which requires you to visit the domain as a first party first. So it's probably that rather than ITP.

Re: First-party isolation in Firefox: what breaks if you enable it?

#120

Post by user812 »

tomrittervg wrote: post #119
user812 wrote: post #112

Earlier quoted context omitted.

Thanks for the clarification. What surprises me the most is that not only Firefox but also my Safari Browser passes all those tests when ITP is enabled.

Safari by default has a stricter storage access policy by default for all third-party domains, which requires you to visit the domain as a first party first. So it's probably that rather than ITP.

I have a general question if you don't mind. I use Firefox Beta. Why is Firefox going the route of a manual blacklist (disconnect) instead of working on some kind of programmatic machine-learning/somewhat intelligent third-party storage blocking by default that doesn't discriminate known against unnkwon trackers?
Post reply on HN